Experimental Eavesdropping Based on Optimal Quantum Cloning 
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The security of quantum cryptography is guaranteed by the no-cloning theorem, which implies 
that an eavesdropper copying transmitted qubits in unknown states causes their disturbance. Nev- 
ertheless, in real cryptographic systems some level of disturbance has to be allowed to cover, e.g., 
transmission losses. An eavesdropper can attack such systems by replacing a noisy channel by a 
better one and by performing approximate cloning of transmitted qubits which disturb them but 
below the noise level assumed by legitimate users. We experimentally demonstrate such symmet- 
ric individual eavesdropping on the quantum key distribution protocols of Bennett and Brassard 
(BB84) and the trine-state spherical code of Renes (R04) with two-level probes prepared using a 
recently developed photonic multifunctional quantum doner [K. Lemr et al, Phys. Rev. A 85, 
050307(R) (2012)]. We demonstrated that our optimal cloning device with high-success rate makes 
the eavesdropping possible by hiding it in usual transmission losses. We believe that this experiment 
can stimulate the quest for other operational applications of quantum cloning. 

PACS numbers: 42.50.Ex, 03.67.Ac, 03.67.Dd, 03.67.Lx 



During the last decades, there has been much interest 
in secure quantum communication [l|, Q . Quantum key 
distribution (QKD) devices (apart from quantum metrol- 
ogy, random number generators and adiabatic comput- 
ers based on quantum annealing) are arguably the only 
second-generation quantum technologies providing com- 
mercially available applications of quantum information 
and quantum optics up to date [3| . The security of QKD 
follows from Heisenberg's uncertainty relation or, equiv- 
alently, the no-cloning theorem. However, QKD can be 
secure only below some level of noise that unavoidably oc- 
cur in any physical system. Therefore, security bounds of 
QKDs are expressed in terms of tolerated losses or noise. 

For QKD to be secure Alice and Bob must operate on 
single photons; hence, they need a single-photon source 
(SPS). SPSs are usually implemented as a weak coherent 
pulse of light Q; thus, QKD are prone to photon-number 
splitting attacks. This attack can be circumvented by, 
e.g., using decoy states [4] or heralded SPS instead of 
weak coherent pulses. Since there are no lossless chan- 
nels, if the eavesdropper (Eve) is equipped with a proper 
cloning machine mimicking the lossy channel then she 
can clone (a part of) the state sent by Alice, while hiding 
her presence in usual transmission losses. 

Recent proposals of applications of quantum cloning [5[ 
range from quantum cryptography [6J and quantum 
metrology Q to nonclassicality tests in microscopic- 
macroscopic systems @ and, even, proposals related to 
quantum experiments with human eyes Q. 



'Electronic address: 
t Electronic address: 



bartkiewicz@jointlab.upol.cz 



k.lemr@jointlab.upol.cz 



In this Letter, we experimentally demonstrate the use- 
fulness of cloning for quantum cryptoanalysis, i.e., for the 
eavesdropping of QKD over noisy quantum channels. 

There are a number of well-known QKDs including 
the famous BB84 of Bennett and Brassard [lfj based 
on mutually unbiased bases and the biased-bases R04 
of Renes [11| . Attacks on those protocols can be classi- 
fied as individual (or incoherent) and coherent (including 
joint and collective) Every attack can be imagined 
as follows: Eve sends a photon (probe) prepared in some 
polarization state which interacts with a photon sent by 
Alice, then Eve sends a photon to Bob and performs a 
measurement on her probe (she might wait until the key 
sifting process is over). Recently, attacks on QKD were 
proposed exploiting technological loop holes rather than 
the limits imposed by physics [13 . Il3| . However, in this 
Letter we analyze the physical bounds on the security of 
the QKDs. 

We focus only on individual attacks on the two QKDs 
assuming that Eve waits until Alice and Bob complete 
key sifting and then performs her measurements. This 
kind of attack requires that Eve has access to quantum 
memory (QM) in order to store her probes during the 
key sifting, but does not require Eve to perform a co- 
herent measurement on many photons at a time. Such 
satisfactory memory has not been invented yet; however, 
recent encouraging results [l4| carry the promise of real- 
izing good QMs in near future. Moreover, in our opinion, 
coherent multi-qubit readout may require an additional 
technological leap. For clarity of presentation we focus 
only on trine-state R04 and BB84. Nevertheless, our ap- 
proach can be used for analyzing generalizations of those 
protocols. By referring hereafter to R04 we mean its 
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FIG. 1: (Color online) Diagram describing R04 [11] . Alice 
(Bob) publicly agrees beforehand to send (measure) one of the 
trine states marked by red (black) dots, respectively. Both 
agree that the clockwise (anticlockwise) sequence of their 
states corresponds, e.g., to bit 1 (0). Bob publicly informs 
Alice what he has not measured (marked by an exclamation 
mark) . Alice ignores the inconclusive cases (and informs Bob 
about them). In the other two cases, Alice and Bob obtain 
the same bit value. 



trine-state version. 

It is known that the acceptable quantum bit error rate 
(QBER), i.e., the ratio of the number of wrong qubits to 
the total number of qubits received, is 15% 15[ for BB84 
and 16.7% " 
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for R04 assuming an individual attack 
with a four-level probe and that Eve does not wait for the 
key sifting. These QBER bounds could suggest that R04 
is more robust to eavesdropping than BB84. However, 
it was shown that, by assuming one-way communication 
between Alice and Bob, BB84 is unconditionally secure if 
QBER < 11% [3, while R04 if QBER < 9.85% [H. On 
the other hand, if Eve waits for the key sifting process to 
finish, BB84 is secure if QBER < 14.6% [3 (or 15% 
for the two- level probe), while the corresponding QBER 
bound for R04 is unknown to our knowledge. Neverthe- 
less, in this Letter we show that the QBER bound for 
R04 and BB84 is 16.7% for the optimal cloning attack 
with a two-level probe. 

The algorithm for the cloning-based eavesdropping in- 
vestigated in our Letter reads as follows: (i) Eve plugs 
a cloning machine together with QM into the quantum 
communication channel between Alice and Bob. (ii) Al- 
ice sends one of the states used in BB84 or R04. (hi) 
Eve intercepts the state and prepares two noisy copies. 
This cloning introduces losses, (iv) Eve sends one copy to 
Bob and keeps the other copy in QM. (v) Bob measures 
the received copy, (vi) Alice and Bob publicly perform 
key sifting, (vii) Eve performs positive-valued measures 
(POVMs) on each of the stored qubits to guess the bit 
value that was obtained by Alice and Bob simultaneously. 
She assigns corresponding bit values to her measurement 
outcomes. The steps performed by Eve are discussed be- 
low (for additional details see Ref. [2(| )■ Since, in our 
experiment, we do not have access to QM we simulate 
it by performing a reconstruction of the two-qubit den- 
sity matrix shared by Eve and Bob and later by project- 
ing Bob's part of the state onto one of the bases used in 
QKD. The reduced density matrix describing Eve's qubit 
is assumed to be stored in QM. 

Symmetric attacks on QKD can be performed by us- 
ing a multifunctional optimal quantum doner (OQC) [l|. 
In R04 [ll| (explained in Fig. [1]) Alice sends one of the 



three equally separated equatorial qubits \a n ) = Af[\H) + 
exp(i2n7r/3)|V0] and Bob detects \b n ) = Af[\H) + 
cxp(i2mr/3 + Z7r/3)|y)], where n — 0, 1, 2 and Af = 
1/V2. Since all the states used in R04 (and also in 
BB84) are on the equator of the Bloch sphere (say xy 
plane), we require that Eve's action causes the Bloch 
sphere of the qubit received by Bob to shrink uniformly 
in the xy plane (qubit's purity decreases) so that her 
presence cannot be easily detected. Thus, the density 
matrix of Bob's qubit reads as ps = \ [1 + ifjB "?b ) ■ <?b], 
where the Bloch-sphere shrinking is described by matrix 
r\s = diag(?7, 77, rj±), where r\ (r]±) is the shrinking fac- 
tor in the xy plane (z direction), r is the Bloch vector 
of the initial qubit, and a = (a x , a y , a z ) is a vector of 
Pauli's matrices. Our OQC [l] provides the following 
shrinking factors r] = 2^/pKk and -q±_ = A 2 + A 2 (p — q), 
where q + p — 1 and A 2 + A 2 = 1 assuming that 
p, q, A, A € [0, 1], where p is the asymmetry parameter of 
the clones and A is the cloning "strength" since it affects 
the purity of the clones (related to the shrinking factors) 
in the same way. In our experiment we fix values of p and 
A by adjusting polarization sensitive filtering in BDAs 
(see Fig. [5] and Ref. [20]). Moreover, for Eve's probe we 
obtain t)e{j), A) = t]b(Qi A). This operation is similar to 
the one of the mirror phase-covariant doner |l|, l22| . The 
difference depends on p which implies that the states of 
Eve and Bob have different fidelities with respect to the 
states sent by Alice. Furthermore, the fidelity of Bob's 
qubits is Fs{p, A) = (l+2«/pAA)/2, whereas Eve obtains 
Fe(p,A) = Fs{q,A). The unitary cloning transforma- 
tion reads as \H) A -> [A\H,H,0)+A\ip(p), 1)] b e anc and 
\V) A -> [A|V,V,1> +A|V(g),0)] s , E , anc , where \^{p)) = 
t/p\H, V) + y/q\V, H). The resulting state shared by Bob 
and Eve is obtained by tracing out the ancilla, which 
in our experiment corresponds to random switching be- 
tween H- and V^-polarized photons used by Eve as probes. 
For p = A 2 = 1/2 the OQC becomes the symmetric 
1 — > 2 phase-covariant doner 23] , which for BB84 causes 
QBER = 1 - F B = 14.6%. Moreover, for p = 1/2 and 
A 2 = 2/3, the OQC becomes the universal doner [24| . 
We assume Eve's probe to be a qubit, while the most 
general approach requires the probe to be a four-level 
system. Our restriction is valid if two-photon interac- 
tions |l| are only used for the eavesdropping. 

Optimal eavesdropping strategy. — Eve knows the ini- 
tial state of her photon as her OQC performs conditional 
operations [l|, [20j , where the asymmetry is implemented 
by introducing additional losses 25]. However, Eve, to 
optimize her attack on R04, must choose the optimal 
strategy for distinguishing between Bob's measurement 
results b n and 6 n ®i given that Alice sent a n and a n @2, 
respectively, where ® stands for sum modulo 3. While 
restricting Eve's readout to the von Neumann's measure- 
ments we found the optimal ones maximizing Eve's infor- 
mation (this follows from the symmetry of the shrin king 
factors) to be equivalent to Helstrom's measurements |2q ] 
discriminating between states \b n ) and |&n©i) (or \a n ) and 
|fln©2)) independent of the values A, p, and the initial 
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FIG. 2: (Color online) Experimental setup as described in the 
text. States of the probed and ancillary photons are prepared 
with half-wave (HWP) and quarter-wave (QWP) plates. The 
photons overlap on the polarization-dependent beam split- 
ter (PDBS) and undergo polarization-sensitive filtering in the 
beam divider assemblies (BDAs) . Each BDA (see figure inset) 
consists of a pair of beam dividers (BDs), a neutral density 
filter (F), and a half- wave plate (HWP). The tomography of 
the two-photon state is accomplished by means of the HWPs, 
QWPs, polarizing beam splitters (PBDs), and single-photon 
detectors (D). 



state of the probe. Thus, Eve's measurement is a pro- 
jection on equatorial qubits of phase 2n7r/3 + 7r/6 + mix 
(2n7r/3 + 57r/6-r-m7r) if Bob's message (see Fig. [J} is \\b n ) 
(!|&ne2))i where m = 0, 1 is Eve's bit value. For BB84, 
Eve uses the measurement as Bob. 

For the measurements we calculated [2(| the mu- 
tual Shannon information Ix.y between the three users, 
where A", Y stand the initials of the corresponding par- 
ties. Next, we calculated the secret-key rate (i.e., the 
lower bound on the distilled key length per number of the 
sifted-key bits) R = Ia,b~ min(7A,E, Ib,e) H3 as a func- 
tion of A and p. Finally, we found the optimal cloning 
attack by maximizing Ia,b for R = 0. The results of our 
theoretical analysis, as summarized in Fig. [31 imply that 
the optimal (cloning restricted) two-level-probe individ- 
ual attack on R04 yields QBER = 16.7% for A 2 = 4/11 
and p = 4/7. Our results for the analogous strategy for 
BB84 are shown in Fig. [31 where the best attack yields 
QBER = 16.7% for A 2 = 1/3 and p = 1/2. The QBER 
depends on the fidelity of cloning [QBER = 1 — Fb for 
BB84 and QBER = 4(1 - F B )/{5 - 2F B ) for R04], while 
the information extracted by Eve depends both on the 
fidelity (as does Ia,e) and the entanglement of clones 
(correlations between Bob's and Eve's qubits). Thus, 
the optimal attack must balance these two quantities to 
provide R — for a given Ia,b- 

Experimental aspects of the eavesdropping. — In order 
to implement the cloning attack, we employed the exper- 
imental setup (see Fig. [2]), which consists of three main 
parts: the source of photon pairs, the doner and the two- 
photon polarization analyzer. Spatially-separated pho- 
ton pairs of A = 826 nm wavelength are created in non- 
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FIG. 3: (Color online) Cloning parameters, QBER and the 
cloning-attack security of the (a) BB84 and (b) R04 as a 
function of the cloning asymmetry parameter p and cloning 
"strength" A. Dashed red lines show the QBER bound cor- 
responding to the zero-length distilled key, i.e., R = Ia,b — 
min{lA,E, Ib,e) = 0. Thus, cloning enables successful eaves- 
dropping in the regions marked by names of the QKDs. The 
optimal cloning attacks cause QBER = 16.7% if p = 0.57 and 
A 2 = 0.36 (point O") for R04 and p = 0.5 and A 2 = 0.33 
(point O') for BB84. The vertical solid red lines show the 
QBER bounds on the privacy of directly transmitted informa- 
tion corresponding to Ia.b = Ia.e, which are equal to 15.0% 
for R04 and 14.6% for BB84. The area of A 2 > 1/2 (A 2 = 1/2) 
corresponds to the mirror phase-covariant OQC (the 
asymmetric phase-covariant OQC 5, 25]). Hatched areas in- 
dicate the range of the cloning attacks without using quantum 
memory. 



colincar type I degenerate spontaneous parametric down- 
conversion process in L1IO3 crystal (1 cm thick) pumped 
by a cw Kr + laser beam (TEMoo mode, 250 mW of op- 
tical power) . Our source approximates two synchronized 
SPSs with the accuracy adequate for our demonstration, 
since the probability of having more than one photon 
in a mode for the 1 ns detection window is much lower 
than the probability of single-photon detection (approx. 
10~5 [20]). The emitted photons are in a separable po- 
larization state; hence, Alice's state encoded as the signal 
does not change the polarization of the probe. Random 
choice of the states sent by Alice ensures that the po- 
larization of the two photons is uncorrelated. This cor- 
responds to having two independent but synchronized 
SPSs. However, in a real attack Eve would have to use 
a separate SPS. The photons propagate from the source 
to the OQC input via single-mode fibers. The photons 
are coherently superposed on the polarization-dependent 
beam splitter (PDBS). Next, the photons are subjected 
to polarization-sensitive filtering in both output modes 
(see BDA in Fig. Finally, we postselect on coinci- 
dences - one photon in each of the two output modes of 
the doner - and carry out polarization analysis of the 
two-photon state [28| . Using our tomographical data, we 
estimated the two-photon density matrix applying the 
maximum likelihood method [29] . We used the tomogra- 
phy results to numerically simulate Eve's attack assum- 
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TABLE I: Performance of the OQC for BB84 and R04. The 
experimental values (subscript E) of the QBER and the 
secret-key rate R calculated from the measured density matri- 
ces are compared with theoretical predictions (subscript T). 
The success probability p a of the OQC was estimated as in 
Ref. [IJ . The OQC parameters p and A determine the shrink- 
ing of the Bloch sphere due to the cloning. 
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18.5% ± 1.5% 


15.1% ±1.1% 
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16.7% 


12.7% 


4/7 4/11 
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0.01 ±0.08 


18.0% ± 3.5% 


7.4% ± 0.1% 


4/7 4/11 



ing that she probes Alice's photon, keeps the probe until 
key sifting, a nd p asses the probed photon to Bob (for de- 
tails see Ref. [20] ) - We calculated the QBER and secret- 
key rate and compared them with theoretical predictions 
in Table H 

The results indicate that our attack would be possible 
if QM was available. However, to deploy this device in 
a real QKD network, one has to consider several techno- 
logical aspects of this attack. First, because of its prob- 
abilistic nature, the OQC introduces losses. The success 
probability of 10% — 20% corresponds to 7-10 dB losses. 
Observing such losses might indicate that the line is inse- 
cure. Thus, Eve must mask these losses as usual channel 
losses. Supposing typical fibers losses of 3.5dB/km (as 
for the fibers in our experiment and in [l[), Eve would 
need to replace 2-3 km of the line with a fiber of negligi- 
ble losses. Using photons at telecom wavelengths would 
be more practical than 826 nm light for communicating 
over large distances since, for the telecom-window wave- 
lengths, the loses are ~0.2dB/km [H,i|, which makes the 
distances about ten times larger and Eve's task more dif- 
ficult. Typical detectors, designed for the telecom regime, 
provide low efficiency of about 0.25 (approx. 6dB of 
losses) and high dark-count rate, i.e., noise. Much larger 
losses, which could enable eavesdropping, appear for 
long-range free-space transmission reaching, e.jr 157 dB 
for photons reflected from the Ajisai satellite 30]). 

Eve should also control the unsuccessful cases when 
the signal and the probe propagate to Bob, who can de- 
tect them and raise alarm. Eve can achieve this by using 
quantum nondemolition (QND) measurement [3lj ]. If she 
does not find a photon in her output mode, she will close 
the line towards Bob. Finally, Eve's attack relies on the 
perfect overlap between the signal and the probe photons 
(Hong-Ou-Mandel's interference). Typical full width at 
half maximum (FWHM) of photons generated via spon- 
taneous parametric down-conversion corresponds to tens 
of jim. Thus, the requirement on the two-photon overlap 



is of the order of (im. This corresponds to a few fs. Any 
jitter caused by Alice leads to the reduced two-photon 
overlap, lower purity and fidelity of the output states. 
Eve can however overcome this by performing the QND 
detection at her OQC input, which triggers the cloning 
process but requires photon generation on demand. In 
a real cloning attack Eve has to prepare photons of the 
same spectral properties as the photons sent by Alice. In 
our experiment we use photons at 826 nm with spectral 
width FWHM=8.9 nm (160 fs coherence time). These are 
typical values reached by Alice using a femtosecond laser 
as a photon source. Let us note that the photon peaks 
need to overlap as perfectly as possible making the ac- 
ceptable time difference corresponding to a fraction of 
coherence time which changes as wavelength squared di- 
vided by FWHM. Hence, overlapping is easier for longer 
wavelengths (e.g., in the telecom window) and narrow 
FWHM. Both the parameters should be tuned by Alice 
to maximize the security of the QKD. 

Conclusions. — We investigated the feasibility of sym- 
metric individual attacks on BB84 [l(| and R04 [ll[ as- 
suming that Eve tracks the key sifting and uses a multi- 
functional OQC We optimized quantum cloning such 
that the minimum mutual information between an eaves- 
dropper and a legitimate user was equal to the mutual 
information between the legitimate users at the lowest 
QBER. Thus, legitimate users cannot distil a secret key 
from their raw key bits. Consequently we found tolerable 
QBER for this kind of attack to be 16.7% for BB84 and 
R04. We performed the proof-of-principle experiment in 
which R w was attained for QBER = 18.5% ± 1.5% for 
BB84 and QBER = 18.0% ± 3.5% for R04. Our experi- 
ment together with the reported progress in development 
of QM (see, e.g., [3]) suggest that, even in the presence 
of SPSs and perfect detectors, the QKD could be success- 
fully attacked with a probe similar to ours if Alice and 
Bob tolerate too high QBER (see Table QJ or losses (ap- 
prox. 7dB for our device). Our experiment shows that 
the OQCs are interesting both from the fundamental and 
practical points of view as tools of quantum cryptanaly- 
sis as they establish the security bound for an important 
class of QKDs. 
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Supplementary material: 

In this supplement we give more technical details on 
cloning transformations, cloning-based hacking and ex- 
perimental data processing. We also compare graphically 
our theoretical and experimental tomographic results. 



I. THE CLONING MACHINE 

A. Cloning transformation 

The general phase-covariant cloning transformation is 
given by 



|0)« -> A|000) 6 , e , c - 
|1)„ -> A|lll) 6l - C - 



A(v5|01) 6 ,e + V9|10)6,e)|l)c, 
A(Vp|10) b) e + V5|01)fe,e)|0) c (1) 



in the Hilbert space of the two clones of Bob in mode 
b and Eve in mode e extended by an ancillary mode c. 
Moreover, (1) denotes horizontal H (vertical V) polar- 
ization, while A = yl — A 2 and p = 1 — q are positive 
real numbers. The mode c has to be traced out to provide 
the state shared by Bob and Eve. The transformation (JTJ 
equally disturbs all the equatorial qubits, 



1 



V2 



[|0> +exp(z0„)|l)], 



(2) 



where n = 0, 1, .... We experimentally implemented the 
cloning transformation, given by Eq. ([T]), by fixing the 
values of A and p, and by introducing polarization sensi- 
tive losses in the BDAs. 

Eve, to make her cloning-based eavesdropping not eas- 
ily detectable, ensures that 0's and l's are measured by 
Bob with the same probability. To achieve this, Eve 
uses one of the following transformations with probability 
1/2 : 

U o \a n ,0) = C [A|00)+Ae^"(^|01)+^|10))], 



where C x = ^Jp x /2 with p x (x = 0,1) being the suc- 
cess probability of the transformation U x including the 
transmission losses and the probability of having a single 
photon in each mode. Note that p x should not depend 
on n since the cloning is phase-covariant, but because of 
experimental imperfections this is not always true. How- 
ever, if p x does not change much with ran, which is the 
case of our doner [l[ , one can replace it with the average 
over n. The transformations U x are implemented by over- 
lapping the signal and probe photons on the polarization- 
dependent beam splitter and polarization-dependent fil- 
ters. It is apparent that in general the resulting state 
shared by Bob and Eve is a mixed state. For convenience 
in the following sections we will use shorthand notation 
\ipx,n) = U x \a n ,x). 



B. Cloning parameters and polarization-sensitive 
losses 



In our implementation we randomly swap between H 
and V initial polarizations of the probe. If the probing 
photon is initially ii-polarized then in order to set A and 
p we have to ensure the following transmittance ratios: 



/ A \ 2 (l- M )(i-^) 



n,v 

T~e,H 

^7 " VVi^p; (i-2m) 2 ' 



. (- 



A 



(4) 



where t XjV stands for the intensity transmittance of the 
polarization y — H, V in the spatial mode of Bob 
(x = b) and Eve (x = e); fj, and v stand for the am- 
plitude transmittance for the H and V polarizations 
of the polarization-dependent beam splitter. In the 
ideal case, the latter transmittances should be equal to 
fj, = (l + l/V3)/2 and v = (l-l/%/3)/2. Due to 
manufacturing imperfections, the real transmittances are 
|U = 0.77 and v = 0.19. If the probe is initially V- 
polarized, we fix 



1~b.H 

i~b,v 



(2u — if 



2(1-/j)(1-//)- 

Te,H = f^VP\ 2 (2^~1) 2 
Te,V \ A J [IV 



(5) 



All the transmittances are set according to Eq. ([5]) in the 
corresponding BDAs. 



II. GAINING INFORMATION FROM A CLONE 
A. The R04 protocol 

In the R04 protocol states sent by Alice and then mea- 
sured by Bob read as 



10) 
10) 



cxp ynr 

exp 17T 



1 



(6) 



where n = 0,1,2. Let us assume that Bob announces 
that he did not measure state \b n ) . If the protocol is con- 
tinued that means that Alice sent \a n ) or |a n ®i), which 
corresponds to Alice obtaining bit value 1 or 0, corre- 
spondingly. The bit value obtained by Bob depends on 
what he measured. If Bob measured |6n©2) (|&n®i)), then 
his bit is 1 (0). Since Eve waits for the Bob's announce- 
ment, she knows the number n. Moreover, she knows the 
initial state of her qubit \x) and by using this knowledge 
she performs the adequate POVM on her qubit. Eve de- 
signs POVMs \e\{x,n)) {ei{x,n)\ (|eo(a;, n)) (eo(x, n)|) in 
advance in order to discriminate between Alice and Bob 
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FIG. 4: (Color online) The reconstructed two-photon state 
p cx shared by Eve and Bob compared to the experimental 
prediction p t h if Eve has probed |ai) with the ff-polarized 
photon in R04: (a) theory and (b) experiment. The fidelity of 

experimental matrix calculated as F = (Tr y^/^thPcx ^/fith) 
is 98%. The complete density matrix describing Bob's and 
Eve's photons is a mixture of density matrices for Eve using 
V- and ff-polarized photons. 




I Theory 



o.s\ ^c~?^~~^Z^yn °A 



In order to calculate \e m {x,n)) let us first introduce the 
following ancillary states 

\e m (x, n)) — (6 n ©(i+ m ) \lpx,n®(l-m) ), (9) 

where m = 0, 1. For the ancillary states we can calculate 
the Bloch vectors as 

e m (x,n) = (e m (x,n)\a\e m (x,n)), (10) 

where a = (a x ,a y ,a z ). Then, one can easily derive the 
Bloch vectors describing the Eve's POVMs as follows 

^1— m 

e m — T~Z r 
l^m ^1 — ml 

= (sm0 m cos^ m ,sin0 m sinip m ,cos0 m ). (11) 

These measurement directions are known to be optimal 
for the state estimation and correspond to Helstrom's 
measurement. With the help of Eq. (TTT]) . Eve's POVMs 
are defined by the following pure states 

|e m ) =cos^|0)+e^sin^|l). (12) 

Therefore, for the R04 protocol we are able to easily cal- 
culate the joint probability distribution of all the parties 
obtaining various bit values by knowing the state shared 
by Eve and Bob after the cloning transformation. In our 
experiment this state is obtained by the two-qubit polar- 
ization tomography (see Fig.H]). 



b) 




| Experiment 





FIG. 5: (Color online) Same as in Fig.Q]but for BB84, where 
Eve has probed |ao) with the l/-polarized photon. Here, the 
fidelity of experimental matrix is 96%. 



both getting l's (0's). The joint probability of obtaining 
bit values k by Alice, I by Bob, and m by Eve is given by 

Px.n 

(k,l,m) = N x . n \(b n@{1+l) ,e m (x,n)\ij 

s,nffi(l— fe)/| i 

where the normalization constant N x ^ n ensures that 
Sfe / m Px,n(k, I, m) = 1. Therefore, the final probabil- 
ity distribution is given as 



1 1 2 

p(k,l,m) = a^2^2px,n( k ' l ' r > 



(8) 



B. The BB84 protocol 

In the BB84 protocol states sent by Alice and measured 
by Bob read as 



|0) +exp(z7r|) |1) 
|0) +exp (iir- 



(13) 



where n = 0, 1, 2, 3. In case of the BB84 protocol Alice 
sends \a ) and |a 2 ) for the first basis (e.g., X basis), and 
|ai) and \a 3 ) for the second basis (e.g., Y basis). For the 
analyzed class of attacks, we assume that Eve knows the 
basis because she listens to the public announcements of 
Alice and Bob. Since Eve focuses only on the cases when 
the bases of Alice and Bob match, we can simply write 
the joint probability function as 



Px,y(k,l,m) = N Xt y\(b 2 l+y, e m \lp x ,2k+y)\' 



(14) 



where N X}V = 1/ J2k,i,m Px,y(k, I, m) and x, y — 0, 1 enu- 
merate the initial state of Eve's qubit and the basis in 
the BB84 protocol, correspondingly. Therefore, the final 
probability distribution, which is used to calculate the 
mutual information between all the parties, is given as 



p(k,l,m) = - ^2 Px,y( k , l , m )- 

x,y=0 



(15) 
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However, as in the case of the R04 protocol, we need to 
express \e m (x,y)} in terms of the information available 
to Eve. The qubits obtained by Eve read as 

\e m (x,y)} = (by +2m ,\'lpx,y+2m)- (16) 

Next, Eve constructs her POVMs analogously to the case 
of R04, i.e., by first using Eq. (JTTJ) and then Eq. (fT2]). 

C. Experimental data processing 

Since, in our experiment, we automatically reconstruct 
a two-photon density matrix describing a pure state 
shared by Bob and Eve 

Px,n = Px^x,*) ($x,n\- ( 17 ) 

In our experiment the purity of the two reconstructed 
components is usually about 97% (see Figs. [4] and [5]). 
We are able to calculate the probability distributions 
Pk,i,m directly from the experimental data using Eqs. flSJ) 
and (|15[) . This is because we can rewrite the expressions 
for the probabilities comprising the joint distributions us- 
ing the density matrix formalism and the reconstructed 
matrices directly. Note that the expression for the joint 
probabilities implicitly assume that the success rate is 
uniform for all the configurations. 

This success rate p s , assumed to be uniform, is esti- 
mated in the first approximation by p x averaged over 
all the equatorial states used in the discussed protocols. 
In the experiment we obtain p x by comparing coinci- 
dence rate with and without applying the polarization- 
dependent beam splitter and polarization-dependent fil- 
ters. Moreover, if Eve wants Bob's results to be sym- 
metric with respect to swapping between the H and V 
polarizations, she should provide (if necessary by intro- 
ducing additional losses) p s — p x= o — p x =i- Alterna- 
tively, if p x varies little with x, Eve can do nothing and 
then p s can be approximated by (po +pi)/2. The success 
rates p s given in Tab. I were obtained by the following 
prescription. 

The measured probability distributions p(k, I, m) = 
PA.B,E{k,l,m) for Alice, Bob, and Eve having various 
bit values are used to establish the real quantum bit er- 
ror rate (QBER) for the both analyzed protocols as dis- 
cussed in our Letter. However, for establishing the secret 
bit rate R of the sifted key bits, first we determine the 
mutual Shannon information between the parties using 
the standard formula 

T T / M \ PX,Y(x,y) ' 

Ix,y = W.x = y. Px.Y(x,y)\og 2 — — — — , 

YPx(x)p Y (y)_ 

(18) 

where px,y(x,v) = J2l=oPx,Y,z(x,y, z) and px{x) = 
El=vPx,Y(x,y) for {X,Y,Z} = {A, B, E}. Using 
Eq. (|18l) one can easily verify that the mutual informa- 
tion between Alice and Bob is simply given by Ia.b — 



1 + S\og 2 5 + (1 — 5) log 2 (l — 6) in terms of the probability 
5 of Bob obtaining a wrong bit value, which corresponds 
to the QBER. 

Note that the cloning operation works with the success 
rate p s < 1 and for the remaining cases we do not detect 
any coincidences. Thus, for the particular initial state 
of the cloning machine, a fraction of r = 1 — p s of the 
photons sent by Alice is absorbed by the cloning machine. 
In our experiment this fraction is about r ~ 80%, which 
corresponds to about 7dB of losses. 



III. SOURCE OF SINGLE PHOTONS 

In this section we demonstrate that the source of 
photons used in our experiments approximates a single- 
photon source (SPS) to be used by Alice in QKD. The 
SPS is approximated by one of the modes of the down- 
converted light. In our experiment the intensity of the 
down-converted light is low to ensure that the proba- 
bility of generating four (and larger numbers) of pho- 
tons is negligible. The photon statistics of such down- 
converted beam is described by a thermal distribution 
P(n) = n n /(l + n n+1 ) @ with a small average number 
of photons n <C 1CU 3 (we ensure that in the experiment). 
Thus, P(n > 1)«0 and we work with an approximate 
source of photon pairs |1)|1), where each of the photons 
is in a different spatial mode. 

Generating a photon in the first-order process is a ran- 
dom event. The down-conversion events appear inde- 
pendently of the number of down-converted photons n in 
the time window of 1 ns, thus the probability of having 
n photons is given by Poisson's distribution: 

P{X,n) — A™ exp(— A)/n!, (19) 

where A = n is the average number of photons in the time 
window. We can calculate the probability of not detect- 
ing any photons in the 1 ns window directly from the 
number of detector clicks N = 35 x 10 3 that appeared as 
P = l-Nx KT 9 = 0.999965. This is correct if the usual 
time interval between two detection events is larger than 
the dead time of the detectors corresponding to about 
35 ns. On the other hand, Po can be also calculated using 
a mathematical model of the ON/OFF (bucket) detectors 
of efficiency r\ (in our experiment rj = 0.5) as 

oo 

P = ^P(A,n)(l- ?7 r, (20) 

n=0 

where the only unknown A is estimated numerically to 
be A = 7.00 x 10~ 5 assuming P = 0.999965 and rj = 0.5. 
Therefore the probability of having more than one photon 
in the time window is equal to 

l 

p>i = i - p ( A = 7 x l0 ~ 5 ' n ) = 2 - 45 x icr9 - ( 2l ) 

n=0 
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Moreover, since the probability of not having photons in 
the 35 ns dead time window is very high as it reaches 
p35( A = 7 00 x 10 -5 n = o) = 0.9976, the above- 



presented reasoning provides results in good agreement 
with our other estimates. 
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